CVE-2026-70475

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Missing Authorization pada flowiseai flowise. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/server/src/routes/executions/index.ts lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results. This issue is fixed in 3.1.3.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fm2f-4339-4p2f advisory vendor
• https://github.com/FlowiseAI/Flowise/commit/96a9b23b5a103b362a0ee1368d04636755be1bed patch
• https://github.com/FlowiseAI/Flowise/pull/6409 issue tracking · patch
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3 release notes